Reject QTI items with entity references instead of raising

[rtibblesbot]

Summary

Entity references (&e;) crashed validate_qti_item and perseus_derive, aborting publish or 500ing the sync API.

• parse_qti_xml raises XMLSyntaxError on entity nodes; existing callers already handle it (is_valid=False, not derivable).
• Rejected, not resolved: secure_parser keeps resolve_entities=False.
• Still accepted: entities in attribute values, unused <!ENTITY>, bare <!DOCTYPE>, &.

References

Fixes #6234. Same class as #6229 (comment nodes); reconcile the two parse_qti_xml checks if that lands differently.

Reviewer guidance

• Tests: validator, derivation, sync-API create, channel publish (item excluded).
• Not run locally (no pytest in the agent's environment); rely on CI.
• Error has no column; lineno comes from the entity node.

AI usage

Implemented with Claude Code from a written plan, test-first. I reviewed the diff for scope.

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

• Ran pre-flight CI checks (lint, format, tests) and verified all pass
• Rebased onto the target branch and resolved any conflicts
• Reorganized commit history into clean, logical commits
• Audited the diff to ensure only issue-relevant files are changed
• Built PR body from the repository's PR template with evidence blocks

🟡 Waiting for feedback Last updated: 2026-09-30 18:53 UTC

[rtibblesbot]

Outside this PR's scope — tracked under #5998:

• [QTI] A QTI item with an entity in a media src attribute is published with an unrewritten path #6240 [QTI] A QTI item with an entity in a media src attribute is published with an unrewritten path

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

• Ran pre-flight CI checks (lint, format, tests) and verified all pass
• Rebased onto the target branch and resolved any conflicts
• Reorganized commit history into clean, logical commits
• Audited the diff to ensure only issue-relevant files are changed
• Built PR body from the repository's PR template with evidence blocks

[rtibbles]

Changes make sense - and good to see the secure option to not resolve the entities is already set, this is just taking the next step to raise a validation error with them.